registry / @dotenvx/dotenvx / 2.37.0
@dotenvx/dotenvx@2.37.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe apparent secret is a documentation example, and the download-and-run path belongs to the explicitly invoked update command. The reviewed version check and Armor login flows are consistent with the package's update and credential-management features.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs a CLI command, such as update or Armor login; the library entry point does not trigger the reviewed actions by itself.
Impact
No unauthorized collection or unrelated execution was found in the reviewed paths.
Mechanism
The packaged-binary update command runs the published dotenvx installer. The version check fetches a version string, and login sends device and system details to the configured Armor service.
AI rationale
The apparent secret is a documentation example, and the download-and-run path belongs to the explicitly invoked update command. The reviewed version check and Armor login flows are consistent with the package's update and credential-management features.
Network endpoints1
dotenvx.sh/VERSION
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook; its executable entry points are the library and CLI.
- The critical-looking private-key text is a sample value inside `dotenvx set` help documentation.
- The update command is explicitly registered as a CLI action; its installer command runs only in the packaged-binary case.
- The version check contacts `https://dotenvx.sh/VERSION` only when invoked and no check has occurred in the prior 24 hours.
- Armor login sends device public-key and basic system information to the configured Armor service as part of the login flow.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
79const set = function () {
return `
Examples:
\`\`\`
$ dotenvx set KEY value
$ dotenvx set KEY "value with spaces"
$ dotenvx set KEY -- "---value with a dash---"
$ dotenvx set KEY -- "-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
-----END OPENSSH PRIVATE KEY-----"
\`\`\`
`
}
const del = function () {
return `
Examples:
Low
Ai Review Evidence
The critical-looking private-key text is a sample value inside `dotenvx set` help documentation.
src/cli/help.jsView on unpkg · L79Findings
2 Critical1 High1 Medium8 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli/help.js
LowAi Review Evidencesrc/cli/dotenvx.js
LowAi Review Evidencesrc/db/session.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.37.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.37.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.